General Assembly

of Maryland

About Statutes

This page accesses the Code of Maryland (Statutes) and the Maryland Municipal Charters and Resolutions
as compiled and maintained by the Department of Legislative Services.

The Code is arranged by and organized into “Articles”
(e.g. Transportation Article), which are further subdivided into “titles”, “subtitles”, “sections”,
“subsections”, “paragraphs”, subparagraphs”, etc.

Note that the “official” compilation of the laws (Chapters) enacted at each
session of the General Assembly is published by the State as the “Laws of Maryland”,
commonly referred to as the “Session Laws”. The Session Laws for each session are compiled
chronologically by chapter number and serve as the source law from which the statutes
accessed here are derived.

While the “Laws of Maryland” (Session Laws) constitute the official laws of the State, this Code
and the annotated versions noted below are accepted as “evidence” of the law in all State courts
and by all public offices and officials (See § 10-201 of the Courts & Judicial
Proceedings Article). However, in the event of a conflict between the Code and the Session Laws,
the Session Laws prevail.

Note: Annotated versions of the Code, published by LexisNexis and West, are available
in book and online formats. These Annotated Codes include references to case law, related
citations, and explanatory notations.

The Municipal Charters are updated each year by incorporating all charter resolutions
received by the Department through May 31 of that year. Individual Municipal Resolutions are published to the General Assembly website as they are received by the Department.

(3) “Security
freeze” means a restriction placed on a consumer’s consumer
report at the request of the consumer that prohibits a consumer reporting
agency from releasing the consumer’s consumer report or any
information derived from the consumer’s consumer report without
the express authorization of the consumer.

(b) (1) This
section does not apply to the use of a consumer’s consumer report
by:

(i) A person, or
a subsidiary, affiliate, agent, or assignee of the person, with which
the consumer has, or prior to assignment had, an account, contract,
or debtor–creditor relationship, for the purpose of account
review or collecting the financial obligation owing for the account,
contract, or debt;

(ii) A person that
was given access to the consumer’s consumer report under subsection
(e) of this section for the purpose of facilitating an extension of
credit to the consumer or another permissible use;

(iii) A person
acting in accordance with a court order, warrant, or subpoena;

(iv) A unit of
State or local government that administers a program for establishing
and enforcing child support obligations;

(v) The Department
of Health and Mental Hygiene in connection with a fraud investigation
conducted by the Department;

(vi) The State
Department of Assessments and Taxation, the Comptroller, or any other
State or local taxing authority in connection with:

1. An investigation
conducted by the Department, Comptroller, or taxing authority;

2. The collection
of delinquent taxes or unpaid court orders by the Department, Comptroller,
or taxing authority; or

3. The performance
of any other duty provided for by law;

(vii) A person
for the purpose of prescreening, as defined by the federal Fair Credit
Reporting Act;

(viii) A person
administering a credit file monitoring subscription service to which
the consumer has subscribed;

(ix) A person providing
a consumer with a copy of the consumer’s consumer report on
request of the consumer; or

(x) To the extent
not prohibited by other State law, a person only for the purpose of
setting or adjusting an insurance rate, adjusting an insurance claim,
or underwriting an insurance risk.

(2) This section
does not apply to:

(i) A check services
or fraud prevention services company that issues:

1. Reports on incidents
of fraud; or

2. Authorizations
for the purpose of approving or processing negotiable instruments,
electronic funds transfers, or similar payment methods;

(ii) A deposit
account information service company that issues reports regarding
account closures due to fraud, substantial overdrafts, automated teller
machine abuse, or similar negative information regarding a consumer
to inquiring banks or other financial institutions for use only in
reviewing a consumer request for a deposit account at the inquiring
bank or financial institution; or

(iii) A consumer
reporting agency database or file that consists entirely of consumer
information concerning, and used solely for:

1. Criminal record
information;

2. Personal loss
history information;

3. Fraud prevention
or detection;

4. Employment screening;
or

5. Tenant screening.

(c) (1) A
consumer may elect to place a security freeze on the consumer’s
consumer report by:

(i) Written request
sent by certified mail;

(ii) Subject to
paragraph (6) of this subsection, telephone, by providing certain
personal information that the consumer reporting agency may require
to verify the identity of the consumer;

(iii) Electronic
mail using an electronic postmark if a secure electronic mail connection
is made available by the consumer reporting agency; or

(iv) If the consumer
reporting agency makes a secure connection available on its Web site,
an electronic request through that secure connection.

(3) Except as provided
in paragraph (5) of this subsection, a consumer reporting agency shall
place a security freeze on a consumer’s consumer report within
3 business days after receiving a request under paragraph (1) of this
subsection.

(4) Within 5 business
days after placing a security freeze on a consumer’s consumer
report, the consumer reporting agency shall:

(i) Send a written
confirmation of the security freeze to the consumer;

(ii) Provide the
consumer with a unique personal identification number or password
to be used by the consumer when authorizing the release of the consumer’s
consumer report to a specific person or for a specific period of time;
and

(iii) Provide the
consumer with a written statement of the procedures for requesting
the consumer reporting agency to remove or temporarily lift a security
freeze.

(5) (i) Subject
to subparagraph (ii) of this paragraph, a consumer reporting agency
is not required to place a security freeze on a consumer report if
the consumer reporting agency:

1. Acts only as
a reseller of credit information by assembling and merging information
contained in a database of another consumer reporting agency or multiple
consumer reporting agencies; and

2. Does not maintain
a permanent database of credit information from which new consumer
reports are produced.

(ii) A consumer
reporting agency that acts as a reseller of credit information shall
honor a security freeze placed on a consumer report by another consumer
reporting agency.

(6) (i) If
a consumer requests placement of a security freeze by telephone under
paragraph (1)(ii) of this subsection, the consumer reporting agency
may require the consumer to confirm the request in writing on a form
that the consumer reporting agency provides to the consumer with the
materials sent in accordance with paragraph (4) of this subsection.

(ii) If the consumer
fails to return written confirmation that the consumer reporting agency
requires under subparagraph (i) of this paragraph, the consumer reporting
agency may remove the security freeze in accordance with subsection
(g)(2) of this section.

(d) (1) While
a security freeze is in place, a consumer reporting agency may not
release a consumer’s consumer report or any information derived
from a consumer’s consumer report without the express prior
authorization of the consumer.

(2) A consumer
reporting agency may advise a person that a security freeze is in
effect with respect to a consumer’s consumer report.

(3) A consumer
reporting agency may not state or imply to any person that a security
freeze on a consumer’s consumer report reflects a negative credit
score, credit history, or credit rating.

(e) (1) If
a consumer wants to temporarily lift a security freeze to allow the
consumer’s consumer report to be accessed by a specific person
or for a specific period of time while a security freeze is in place,
the consumer shall:

(i) Contact the
consumer reporting agency by:

1. Mail in the
manner prescribed by the consumer reporting agency;

2. Telephone in
the manner prescribed by the consumer reporting agency;

3. Electronic mail
using an electronic postmark if a secure electronic mail connection
is made available to the consumer by the consumer reporting agency;
or

4. Electronic request
if a secure connection is made available on the Web site of the consumer
reporting agency;

(ii) Request that
the security freeze be temporarily lifted; and

(iii) Provide the
following to the consumer reporting agency:

1. Proper identifying
information;

2. The unique personal
identification number or password provided to the consumer under subsection
(c)(4)(ii) of this section; and

3. The proper information
regarding the person that is to receive the consumer report or the
time period during which the consumer report is to be available to
users of the consumer report.

(2) (i) Except
as provided in subparagraph (ii) of this paragraph, a consumer reporting
agency shall comply with a request made under paragraph (1) of this
subsection within 3 business days after receiving the request.

(ii) 1. A
consumer reporting agency shall comply with a request made under paragraph
(1) of this subsection within 15 minutes after the consumer’s
request is received by the consumer reporting agency if the request
is made by telephone, by electronic mail, or by secure connection
on the Web site of the consumer reporting agency.

2. A consumer reporting
agency that is unable to temporarily lift a security freeze under
subsubparagraph 1 of this subparagraph shall lift the security freeze
as soon as it is reasonably capable of doing so.

(3) A consumer
reporting agency may develop procedures involving the use of facsimile
or other electronic media to receive and process, in an expedited
manner, a request from a consumer to temporarily lift or remove a
security freeze on the consumer’s consumer report.

(f) If, in connection
with an application for credit or for any other use, a person requests
access to a consumer’s consumer report while a security freeze
is in place and the consumer does not authorize access to the consumer
report, the person may treat the application as incomplete.

(g) (1) Except
as provided in paragraph (2) of this subsection, a consumer reporting
agency may remove or temporarily lift a security freeze placed on
a consumer’s consumer report only on request of the consumer
made under subsection (e) or (h) of this section.

1. Placement of
the security freeze was based on a material misrepresentation of fact
by the consumer; or

2. The consumer:

A. Made the
request to place the security freeze by telephone under subsection
(c)(1)(ii) of this section; and

B. Failed
to confirm the request in writing if required in accordance with subsection
(c)(6) of this section.

(ii) If a consumer
reporting agency intends to remove a security freeze under subparagraph
(i) of this paragraph, the consumer reporting agency shall notify
the consumer in writing of its intent at least 5 business days before
removing the security freeze.

(h) (1) Subject
to subsection (g)(2) of this section, a security freeze shall remain
in place until the consumer requests that the security freeze be removed.

(2) If a consumer
wants to remove a security freeze from the consumer’s consumer
report, the consumer shall:

(i) Contact the
consumer reporting agency by:

1. Mail in the
manner prescribed by the consumer reporting agency;

2. Telephone in
the manner prescribed by the consumer reporting agency;

3. Electronic mail
using an electronic postmark if a secure electronic mail connection
is made available to the consumer by the consumer reporting agency;
or

4. Electronic request
if a secure connection is made available on the Web site of the consumer
reporting agency;

(ii) Request that
the security freeze be removed; and

(iii) Provide the
following to the consumer reporting agency:

1. Proper identifying
information; and

2. The unique personal
identification number or password provided by the consumer reporting
agency under subsection (c)(4)(ii) of this section.

(3) A consumer
reporting agency shall remove a security freeze within 3 business
days after receiving a request for removal.

(i) (1) Except
as provided in paragraph (2) of this subsection, a consumer may not
be charged for any service relating to a security freeze.

(2) A consumer
reporting agency may charge a reasonable fee, not exceeding $5, for
each placement, temporary lift, or removal of a security freeze.

(3) Notwithstanding
paragraph (2) of this subsection, a consumer reporting agency may
not charge any fee under this section to a consumer who:

(i) Has obtained
a report of alleged identity fraud against the consumer under §
8–304 of the Criminal Law Article or an identity theft passport
under § 8–305 of the Criminal Law Article; and

(ii) Provides a
copy of the report or passport to the consumer reporting agency.

(j) At any time
that a consumer is entitled to receive a summary of rights under §
609 of the federal Fair Credit Reporting Act or § 14–1206
of this subtitle, the following notice shall be included:

“NOTICE

You have a right, under § 14–1212.1
of the Commercial Law Article of the Annotated Code of Maryland, to
place a security freeze on your credit report. The security freeze
will prohibit a consumer reporting agency from releasing your credit
report or any information derived from your credit report without
your express authorization. The purpose of a security freeze is to
prevent credit, loans, and services from being approved in your name
without your consent.

You may elect to have a consumer
reporting agency place a security freeze on your credit report by
written request sent by certified mail or by electronic mail or the
Internet if the consumer reporting agency provides a secure electronic
connection. The consumer reporting agency must place a security freeze
on your credit report within 3 business days after your request is
received. Within 5 business days after a security freeze is placed
on your credit report, you will be provided with a unique personal
identification number or password to use if you want to remove the
security freeze or temporarily lift the security freeze to release
your credit report to a specific person or for a specific period of
time. You also will receive information on the procedures for removing
or temporarily lifting a security freeze.

If you want to temporarily lift
the security freeze on your credit report, you must contact the consumer
reporting agency and provide all of the following:

(1) The unique
personal identification number or password provided by the consumer
reporting agency;

(2) The proper
identifying information to verify your identity; and

(3) The proper
information regarding the person who is to receive the credit report
or the period of time for which the credit report is to be available
to users of the credit report.

A consumer reporting agency must
comply with a request to temporarily lift a security freeze on a credit
report within 3 business days after the request is received, or within
15 minutes for certain requests. A consumer reporting agency must
comply with a request to remove a security freeze on a credit report
within 3 business days after the request is received.

If you are actively seeking credit,
you should be aware that the procedures involved in lifting a security
freeze may slow your own applications for credit. You should plan
ahead and lift a security freeze, either completely if you are seeking
credit from a number of sources, or just for a specific creditor if
you are applying only to that creditor, a few days before actually
applying for new credit.

A consumer reporting agency may
charge a reasonable fee not exceeding $5 for each placement, temporary
lift, or removal of a security freeze. However, a consumer reporting
agency may not charge any fee to a consumer who, at the time of a
request to place, temporarily lift, or remove a security freeze, presents
to the consumer reporting agency a police report of alleged identity
fraud against the consumer or an identity theft passport.

A security freeze does not apply
if you have an existing account relationship and a copy of your credit
report is requested by your existing creditor or its agents or affiliates
for certain types of account review, collection, fraud control, or
similar activities.”

(k) If a consumer
reporting agency violates a security freeze by releasing a consumer’s
consumer report subject to a security freeze or any information derived
from a consumer’s consumer report subject to a security freeze
without authorization, the consumer reporting agency, within 5 business
days after discovering or being notified of the release, shall notify
the consumer in writing of:

(1) The specific
information released; and

(2) The name and
address of, or other available contact information for, the recipient
of the consumer report or the information released.

(l) The exclusive
remedy for a violation of subsection (e)(2)(ii) of this section shall
be a complaint filed with the Commissioner under § 14–1217
of this subtitle.